<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Issue</th>
<td>
<a href=https://github.com/llvm/llvm-project/issues/66221>66221</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>
[clang-tidy] crash with std::function capturing a dangling reference
</td>
</tr>
<tr>
<th>Labels</th>
<td>
clang-tidy,
new issue
</td>
</tr>
<tr>
<th>Assignees</th>
<td>
</td>
</tr>
<tr>
<th>Reporter</th>
<td>
SylvanBrocard
</td>
</tr>
</table>
<pre>
When trying to analyze the following code with clang-tidy, I get a crash:
```cpp
//minimal.cpp
#include <functional>
auto f() -> std::function<int()> {
int v;
auto c = [&v]() {
return v;
};
return c;
}
auto main() -> int { return f()(); }
```
The function `f` returns a `std::function` wrapping a lambda with a dangling reference in its capture. The crash doesn't happen if I return a lambda instead of a `std::function`, nor if I capture by value.
Command
```bash
clang-tidy-16 minimal.cpp -- -std=c++20
```
Crash report:
```text
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0. Program arguments: clang-tidy-16 minimal.cpp -- -std=c++23
1. <eof> parser at end of file
2. While analyzing stack:
#0 Calling f() at line 12
#1 Calling main()
#0 0x00007fd657365796 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm-16/bin/../lib/libLLVM-16.so.1+0xfc9796)
#1 0x00007fd6573639e0 llvm::sys::RunSignalHandlers() (/usr/lib/llvm-16/bin/../lib/libLLVM-16.so.1+0xfc79e0)
#2 0x00007fd657365f6b (/usr/lib/llvm-16/bin/../lib/libLLVM-16.so.1+0xfc9f6b)
#3 0x00007fd655ed5fd0 (/lib/x86_64-linux-gnu/libc.so.6+0x3bfd0)
#4 0x00007fd656387c50 vtable for __cxxabiv1::__si_class_type_info (/lib/x86_64-linux-gnu/libstdc++.so.6+0x20bc50)
Segmentation fault (core dumped)
```
```bash
$ clang-tidy-16 --version
Debian LLVM version 16.0.6
Optimized build.
```
But the crash happens with clang-tidy 16, 17, 18, as well as the system 14.0.6 (inside a debian:latest docker) and the system 15.0.7 (on a Ubuntu 23.04 machine).
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJysVl2P2jwW_jXm5ojIcYiBCy4GGLSVutpqp7u9RI59An7rOJHtMEN__Ss7YUhn2ur9Go0C2D7Pefycrwjv9ckibki5JeV-Jvpwbt3m6Wouwm5dK4VTs6pV182XM1oI7qrtCUILwgpz_YYQzgh1a0z7HDdkqxCedTiDNMKe5kGrK2E7-AAnDCBAOuHPpHggdE_o7cnp8C-7blxhB8IOjba6ESabLBfaStMrBFLs6t7KoFsrDCkep3iiDy3UhK0IW8OcFI_gg4o-i4ebDSl22obhSDxAltvBFkDbABdSvP5OaBJIsYcoEeMXUu5H8IkZgMPQO_udLVnuJ7_GA_J1KW6_5d0IbafUIx2y3N6Mx2vdmG_hjnFTcQr5OQZnvDMQTmvC6QjlQcSV99JwCs9OdF0MpwAjmkqJIaQClLAnEzcc1ujQSgRtQQcPUnShd5hBdJmiDKpFbwlbBjiLrkMLuoYPt4u8ImvrAwoFbf1zQjGDbOsGgNETVFe4CNNjNr3wrm0aYdUbSaqYdGnpnpXznMMkw2A-h3nyvZeEbQnbMvoLYXfphg671oWfpXPAlzAsffr4-PD0CL6vGh2roOpPo22spHMInY8gKetPOpz7KpNtQ9jBmMvtY9659jeUgbCD9r5HT9gBhFVwK4nwKnwl5NfghLxJ8xSE_Aqqb7pXqjSD9PfJtScnGhDu1DdoQ-QBf0akYsDLRzxS7LCtY-J2wnl0IAKgTdGttcHhMMvgy1kbHHtIzCcfKUbf93pKcKygsBMm5dytpEUAoy1Czt4dzl8P3-votXdQoC-UUrqsFS-XBS-Xaw5J4ZRv_uqHL5-ctiFp9jmKSNjqfsiJ52Prg0PREMZjXqY-sobk69B7F8Olq1vQck7YoYpUDll239LVx4____c855lvs5ywLX2p5Xq55lO--Ru-xRrpj_j-t7dP-mSF-ZewyqDzt-709ykt10inlNhbCWte_SNXr3k19VNM_ZSoylrR0c8A87LiR76YG237l_nJ9sOGjJg8YRZVrb6jvphC8mK1lCWFSxCVifPLwfEoX15EpS_5oOrx6PVRGuH9MVw7PGpbt3-Agg9qLI07F0YrWd7JPOEplppITbkWvQkRV7YOU42iutP-Uev5QVcjbPGmaOfzCzofu2c6sMdKCwtReRg3IOcZzfithP7TBd3ob6ig6rVR2S8IbPswaTZDb_dvhz7kqTryZXqu4lN4eEZj4mc091cfsIF8EWlEBbT1WmGcMoktKR6MCOgDqFZ-RZdK36rvbMuMZsto28aJ8r-qt6EHVmR0AY2QZ22RsHU2U5tCrYu1mOEm5-sFZ7RYlbPzplpUqyVTHCVdUUbXi2W-wJUqJV-zAisx0xtGWUHXeZGXZUHLDFHFYFaqoJSrWpEFxUZok8WUz1p3mqXmvOGcsXxmRIXGp1crxqYvRIywHWHM4jOk83Gl3M_cJlVO1Z88WVCjffB34KCDSa9pE6ByP0Yhqf9udI6zcpjk72f3rHdm89enT7rj7wEAAP__yqoEvg">